Static task
static1
Behavioral task
behavioral1
Sample
b654d0db45a06e353649ad4a16633984ed6e64ac2406b714616f3635c800d846.exe
Resource
win7-20221111-en
General
-
Target
b654d0db45a06e353649ad4a16633984ed6e64ac2406b714616f3635c800d846
-
Size
1.2MB
-
MD5
0a7285be6e79777b0849641746c2cff0
-
SHA1
7a4413429b0ec7d3b70c8fcb29ece4d3ed4bc7b4
-
SHA256
b654d0db45a06e353649ad4a16633984ed6e64ac2406b714616f3635c800d846
-
SHA512
9b15e9c7b76f52821fd9e8eddea8f4d9e1d89ab380ef0d0195496ae507291a34f96834c6919bf14231c7f36c05ffc2f4168a02394a82e3ed45d3230843598ce3
-
SSDEEP
12288:3Zdu3ZqPk+jAB1VxHRWH0nc2relsX923THIBdmivWWv5Y/0TTb0pSyNpTkcMbOn1:3i2IVxxWH0ncLudmivG/4P0pSyXTL+M
Malware Config
Signatures
Files
-
b654d0db45a06e353649ad4a16633984ed6e64ac2406b714616f3635c800d846.exe windows x86
a195bf5887b210744515c616478ee16f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
wininet
InternetSetOptionW
HttpOpenRequestW
InternetCloseHandle
kernel32
GetFileType
EnterCriticalSection
LeaveCriticalSection
GetFileSize
GetFileSizeEx
WriteFile
ReadFile
FlushFileBuffers
SetEndOfFile
SetFilePointer
FindClose
GetSystemTimeAsFileTime
GetFileAttributesW
FindFirstFileW
OpenThread
LocalAlloc
LocalFree
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryA
FreeLibrary
TerminateProcess
GetVersion
InterlockedIncrement
InterlockedDecrement
GlobalAlloc
GlobalLock
GlobalUnlock
FlushInstructionCache
RaiseException
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
MulDiv
lstrcmpW
CreateMutexW
OpenMutexW
CreateThread
FindNextFileW
lstrcmpiW
LoadLibraryExW
GetStdHandle
QueryPerformanceCounter
GlobalMemoryStatus
GetModuleHandleA
FlushConsoleInputBuffer
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
SetConsoleMode
ReadConsoleInputA
GetConsoleMode
SetConsoleCtrlHandler
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetCommandLineW
IsDebuggerPresent
RtlUnwind
GetStringTypeW
EncodePointer
DecodePointer
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
InterlockedCompareExchange
GetConsoleCP
HeapSize
HeapReAlloc
HeapDestroy
LoadLibraryW
PeekNamedPipe
GetOEMCP
CreateFileW
GetTempPathW
FindResourceExW
FindResourceW
GetModuleFileNameW
GetMailslotInfo
CloseHandle
SizeofResource
LoadResource
Sleep
GetLastError
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
SetLastError
GetCurrentProcessId
GetProcessHeap
HeapFree
HeapAlloc
GetTimeZoneInformation
GetDiskFreeSpaceW
GetModuleHandleW
GetTickCount
GetProcAddress
WideCharToMultiByte
GetVersionExA
MultiByteToWideChar
LockResource
OutputDebugStringW
WriteConsoleW
SetEnvironmentVariableA
SetFilePointerEx
SetStdHandle
ReadConsoleW
FreeEnvironmentStringsW
WaitForMultipleObjects
GetEnvironmentStringsW
user32
GetUserObjectInformationW
FindWindowExW
GetProcessWindowStation
LoadCursorW
GetWindow
GetClassNameW
GetParent
GetDesktopWindow
SetWindowLongW
GetWindowLongW
FillRect
GetSysColor
ScreenToClient
MessageBoxA
ClientToScreen
GetClientRect
GetWindowTextW
SetWindowTextW
RedrawWindow
InvalidateRgn
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
DestroyAcceleratorTable
CreateAcceleratorTableW
ReleaseCapture
SetCapture
GetFocus
SetFocus
CharNextW
GetDlgItem
SetWindowPos
MoveWindow
DestroyWindow
IsChild
IsWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
SendMessageW
RegisterWindowMessageW
PostMessageW
UnregisterClassW
GetWindowTextLengthW
gdi32
GetObjectW
SelectObject
GetStockObject
GetDeviceCaps
DeleteDC
CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
advapi32
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegEnumKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
GetSidSubAuthority
GetSidSubAuthorityCount
RegDeleteValueW
RegQueryInfoKeyW
DeregisterEventSource
ReportEventA
RegisterEventSourceA
GetTokenInformation
ole32
CoTaskMemAlloc
StringFromGUID2
CLSIDFromProgID
CLSIDFromString
OleInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
OleUninitialize
OleLockRunning
CreateStreamOnHGlobal
CoTaskMemRealloc
CoGetClassObject
oleaut32
SysStringLen
VariantInit
VariantClear
LoadTypeLi
LoadRegTypeLi
SysFreeString
VarUI4FromStr
SysAllocStringLen
OleCreateFontIndirect
SysAllocString
comctl32
InitCommonControlsEx
Sections
.text Size: 764KB - Virtual size: 763KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 252KB - Virtual size: 252KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 25KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 139KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE